Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Section 11: Endurance Training Coach (Intervals.icu)
v1.0.12Evidence-based endurance cycling coaching protocol (v11.10). Use when analyzing training data, reviewing sessions, generating pre/post-workout reports, plann...
⭐ 5· 2.4k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (endurance cycling coach) align with the instructions: fetching athlete JSON, dossier/heartbeat templates, report templates, and optionally writing planned workouts. The skill requests no unrelated credentials, binaries, or system paths.
Instruction Scope
Instructions confine operations to workspace files (DOSSIER.md, HEARTBEAT.md), user-configured JSON URLs/paths, and public files in the referenced GitHub repo. It requires fetching latest.json/history.json per protocol. Note: network GETs are performed against raw.githubusercontent.com and any URLs the user places in DOSSIER.md — those feed endpoints determine what data is read.
Install Mechanism
No install spec or code is included; this is instruction-only, so nothing is written or executed by the skill itself during install.
Credentials
The skill declares no environment variables, credentials, or config paths. It does describe optional write operations via push.py / GitHub Actions, which rely on repository secrets configured by the athlete — this is proportional for a feature that writes to a user's Intervals.icu calendar.
Persistence & Privilege
always=false (not forced into every agent). The skill can write DOSSIER.md/HEARTBEAT.md in the workspace during setup and — if push.py is present and the user configures GitHub Actions — can trigger writes to the user's repo/calendar. These write capabilities are expected for the use case but should be enabled only with explicit user consent and correct repo secret configuration.
Assessment
This skill is internally consistent with its coaching purpose, but review a few things before enabling write or automated heartbeats: (1) Verify the GitHub repository (CrankAddict/section-11) and the raw.githubusercontent URLs it fetches to ensure you trust the source. (2) When supplying latest.json/history.json URLs, prefer private repos or local file paths for sensitive data; public URLs will expose training data to anyone with access. (3) If you enable push/write features, inspect push.py and any GitHub Action workflow it triggers and ensure repository secrets are configured securely — the skill does not request credentials itself, but actions you enable may use them. (4) Heartbeat mode is opt-in; only enable scheduled runs if you want the agent to fetch data on a schedule. If you want to be extra cautious, use the skill in read-only mode (local files or view-only repo access) and avoid configuring automated dispatches.Like a lobster shell, security has layers — review code before you run it.
ai-coachvk975634q9dtky8zw4xqgrw71s58146ncai-coachingvk975634q9dtky8zw4xqgrw71s58146nccoachvk975634q9dtky8zw4xqgrw71s58146nccyclingvk975634q9dtky8zw4xqgrw71s58146ncendurancevk975634q9dtky8zw4xqgrw71s58146ncendurance-trainingvk975634q9dtky8zw4xqgrw71s58146ncinterval-trainingvk975634q9dtky8zw4xqgrw71s58146ncintervals-icuvk975634q9dtky8zw4xqgrw71s58146nclatestvk97frrm25kdqbycrw5h23nrmqn828n9fpolarized-trainingvk975634q9dtky8zw4xqgrw71s58146ncstablevk97b2hn8px869zs3ccxzvmegvn80908qtrainingvk975634q9dtky8zw4xqgrw71s58146nctraining-sciencevk975634q9dtky8zw4xqgrw71s58146nc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.